CVE-2018-1103: Openshift Enterprise source-to-image Arbitrary File Write via Archive Extraction (Zip Slip)
Summary
CVE-2018-1103: Openshift Enterprise source-to-image before version 1.1.10 is vulnerable to an improper validation of user input. Affects github.com/openshift/source-to-image versions < 1.1.10-0.20180427153919-f5cbcbc5cc6f. Fixed in 1.1.10-0.20180427153919-f5cbcbc5cc6f. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Openshift Enterprise source-to-image is a Go package used for building reproducible Docker images from source code. It provides a command-line tool that takes in source code and a builder image, and produces a new image that runs the source code. This package is vulnerable to an improper validation of user input, specifically during the extraction of archives. This vulnerability allows an attacker to override files outside of the intended target directory, potentially leading to arbitrary file write attacks.
Vulnerability Detail
The vulnerability in Openshift Enterprise source-to-image arises from a lack of proper validation of user input during archive extraction. An attacker who can trick a user into using the command to copy files locally, from a pod, can exploit this vulnerability to overwrite files outside of the intended target directory. This can lead to unauthorized modification of critical files, potential data loss, or even remote code execution.
How To Fix
Latest published version: v1.6.4 as of 23 Oct 2026
go get github.com/openshift/source-to-image@v1.6.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.1.10-0.20180427153919-f5cbcbc5cc6f
This is the first release that contains the fix.
go get github.com/openshift/source-to-image@v1.1.10-0.20180427153919-f5cbcbc5cc6fTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can manually validate and sanitize any user input before using the source-to-image command for file extraction. This includes checking the file paths and ensuring they are within the intended target directory. Additionally, users should avoid using untrusted or unknown archives for extraction to minimize the risk of exploitation.
Conclusion
The vulnerability in Openshift Enterprise source-to-image exposes users to the risk of arbitrary file write attacks, potentially leading to unauthorized modification of critical files, data loss, or remote code execution. It is crucial for users to update to the latest secure version of the package (1.1.10 or later) and follow recommended best practices to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/openshift/source-to-image →
FAQ
Openshift Enterprise source-to-image is a Go package used for building reproducible Docker images from source code. It simplifies the process of creating containerized applications by automatically handling the build and packaging steps.
The vulnerability allows an attacker to overwrite files outside of the intended target directory during archive extraction. This can lead to unauthorized modification of critical files, potential data loss, or even remote code execution.
Users should update to version 1.1.10 or later of the Openshift Enterprise source-to-image package. This version includes the necessary validation checks to prevent the arbitrary file write vulnerability.
As a workaround, users can manually validate and sanitize any user input before using the source-to-image command for file extraction. Additionally, users should avoid using untrusted or unknown archives for extraction to minimize the risk of exploitation.
Yes, the vulnerability in Openshift Enterprise source-to-image can potentially lead to data loss or remote code execution if an attacker successfully exploits the arbitrary file write vulnerability.
